Getting started

Create the app #

Mini apps are created only in the DiiL app: For business → My apps. To become a developer you need a DiiL account with a verified phone number and email address, you must be at least 18, and you accept the Developer Agreement.

When you create an app, you get its credentials once:

  • client_id is your app's id (as a string).
  • client_secret is never shown again. Keep it on your server. If it is lost or leaked, rotate it: rotation invalidates the old secret, every access token and every refresh token at once.

Scopes #

Scopes are the data you ask users to share. Changing them on a published app goes through review, and users are asked to consent again.

Scope Gives
profile firstName, lastName, languageCode
username username (the DiiL @handle)
avatar avatarUrl
phone phone (E.164), from the userinfo endpoint only
email email (only if verified, otherwise null) and emailVerified, from the userinfo endpoint only

The user id (id) is always included. DiiL has one display name, so it comes as firstName, and lastName is null.

Allowed origins #

allowedOrigins lists the web origins allowed to call the OAuth endpoints from a browser (CORS), for example https://example.com. http://localhost:<port> is accepted for development. Server-to-server calls don't need it.

Testing before review #

Until your app is approved, only you can open it and use the SDK, so you can test it before submitting for review.